Cybersecurity

Overview

OSS-only unified cybersecurity skill: analyze, test, and harden software security using exclusively open-source tooling. Covers threat modeling, web-vulnerability testing (XSS, business logic, Host header, open redirect, forced browsing), SAST / code audit, AI/LLM-app security, and detection engineering (Sigma + MITRE ATT&CK).

Paid tools (Burp Suite, Nessus, Splunk, CrowdStrike, SonarQube, DOM Invader, Hackvertor) appear only as "if you already have it" notes — never as the primary path. For the full paid→OSS swap table, SEE: references/oss-tool-map.md.

This skill fills a gap in this repo: the 5 existing defensive plugins (csrf-protection, xss-prevention, vulnerability-scanning, security-headers-configuration, defense-in-depth-validation) tell you how to fix — this skill tells you how to find, analyze, and threat-model.

When to use

Use this skill whenever the user's task touches software security. Triggers include: